Update to jdk-25.0.4+7 (GA)

- Update release notes to 25.0.4+7 - Bump freetype version to 2.14.3 following JDK-8385390 - Bump giflib version to 6.1.3 following JDK-8384902 - Bump HarfBuzz version to 14.2.0 following JDK-8385490 - Bump lcms2 version to 2.19.1 following JDK-8375065 & JDK-8383354 - Bump libpng version to 1.6.58 following JDK-8384495 - Require tzdata 2026b due to upstream inclusion of JDK-8383175 - Drop local copy of JDK-8375294 EOPNOTSUPP patch ** This tarball is embargoed until 2026-07-21 @ 1pm PT. ** Resolves: RHEL-188883
2026-07-10 22:52:56 +01:00 · 2026-07-10 22:52:56 +01:00 · c6cc2f0044
commit c6cc2f0044
parent a8272180a4
5 changed files with 374 additions and 80 deletions
--- a/.gitignore
+++ b/.gitignore
@ -47,3 +47,4 @@
 /openjdk-25.0.2+10.tar.xz
 /nssadapter-0.1.1.tar.xz
 /openjdk-25.0.3+9.tar.xz
+/openjdk-25.0.4+7.tar.xz
--- a/347
+++ b/347
@ -3,6 +3,353 @@ Key:
 JDK-X  - https://bugs.openjdk.java.net/browse/JDK-X
 CVE-XXXX-YYYY: https://cve.mitre.org/cgi-bin/cvename.cgi?name=XXXX-YYYY

+New in release OpenJDK 25.0.4 (2026-07-21):
+===========================================
+Live versions of these release notes can be found at:
+  * https://bit.ly/openjdk2504
+
+* CVEs
+* Changes
+  - JDK-7184899: Test sun/java2d/X11SurfaceData/SharedMemoryPixmapsTest/SharedMemoryPixmapsTest.sh fail
+  - JDK-8015444: java/awt/Focus/KeyStrokeTest.java sometimes fails
+  - JDK-8064922: [macos] Test javax/swing/JTabbedPane/4624207/bug4624207.java fails
+  - JDK-8068293: [TEST_BUG] Test closed/com/sun/java/swing/plaf/motif/InternalFrame/4150591/bug4150591.java fails with GTKLookAndFeel
+  - JDK-8068310: [TEST_BUG] Test javax/swing/JColorChooser/Test4234761.java fails with GTKL&F
+  - JDK-8144124: [macosx] The tabs can't be aligned when we pressing the key of 'R','B','L','C' or 'T'.
+  - JDK-8203004: UnixMultiResolutionSplashTest.java fails on Ubuntu16.04
+  - JDK-8213530: Test java/awt/Modal/ToFront/DialogToFrontModeless1Test.java fails on Linux
+  - JDK-8221451: PIT: sun/java2d/X11SurfaceData/SharedMemoryPixmapsTest/SharedMemoryPixmapsTest.sh fails
+  - JDK-8225787: java/awt/Window/GetScreenLocation/GetScreenLocationTest.java fails on Ubuntu
+  - JDK-8241066: Shenandoah: fix or cleanup SH::do_full_collection
+  - JDK-8261743: Shenandoah: enable String deduplication with compact heuristics
+  - JDK-8264851: Shenandoah: Rework control loop mechanics to use timed waits
+  - JDK-8278102: containers/docker/TestJcmd.java failed with "RuntimeException: Could not find specified process"
+  - JDK-8279196: Test: jdk/jfr/event/gc/stacktrace/TestG1OldAllocationPendingStackTrace.java timed out
+  - JDK-8297191: [macos] Printing a page range with starting page > 1 results in missing pages
+  - JDK-8298823: [macos] java/awt/Mouse/EnterExitEvents/DragWindowTest.java continues to fail with "No MouseReleased event on label!"
+  - JDK-8319326: GC: Make TestParallelRefProc use createTestJavaProcessBuilder
+  - JDK-8319540: GC: Make TestSelectDefaultGC use createTestJavaProcessBuilder
+  - JDK-8321303: Intermittent open/test/jdk/java/awt/KeyboardFocusmanager/ConsumeNextMnemonicKeyTypedTest/ConsumeNextMnemonicKeyTypedTest.java failure on Linux
+  - JDK-8321687: Test vmTestbase/nsk/jvmti/scenarios/contention/TC03/tc03t002/TestDescription.java failed: JVMTI_ERROR_THREAD_NOT_ALIVE
+  - JDK-8323792: ThreadSnapshot::initialize can cause assert in Thread::check_for_dangling_thread_pointer (possibility of dangling Thread pointer)
+  - JDK-8325482: Test that distinct seeds produce distinct traces for compiler stress flags
+  - JDK-8335355: Shenandoah: Fix race condition in gc/shenandoah/mxbeans/TestPauseNotifications.java
+  - JDK-8339526: C2: store incorrectly removed for clone() transformed to series of loads/stores
+  - JDK-8340182: Java HttpClient does not follow default retry limit of 3 retries
+  - JDK-8341735: Rewrite the build/AbsPathsInImage.java test to not load the entire file at once
+  - JDK-8344345: test/hotspot/gtest/x86/x86-asmtest.py has trailing whitespaces
+  - JDK-8345631: TestRegionSamplingLogging.java#generational-rotation intermittent fails
+  - JDK-8347167: Reduce allocation in com.sun.net.httpserver.Headers::normalize
+  - JDK-8347938: Add Support for the Latest ML-KEM and ML-DSA Private Key Encodings
+  - JDK-8351010: Test java/io/File/GetXSpace.java failed: / usable space 56380809216 > free space 14912244940
+  - JDK-8352914: Shenandoah: Change definition of ShenandoahSharedValue to int32_t to leverage platform atomics
+  - JDK-8353115: GenShen: mixed evacuation candidate regions need accurate live_data
+  - JDK-8354650: [PPC64] Try to reduce register definitions
+  - JDK-8355339: Test java/io/File/GetCanonicalPath.java failed: The specified network name is no longer available
+  - JDK-8357086: os::xxx functions returning memory size should return size_t
+  - JDK-8358600: Template-Framework Library: Template for TestFramework test class
+  - JDK-8358772: Template-Framework Library: Primitive Types
+  - JDK-8359083: Test jdkCheckHtml.java should report SkippedException rather than report fails when miss tidy
+  - JDK-8359223: HttpClient: Remove leftovers from the SecurityManager cleanup
+  - JDK-8359412: Template-Framework Library: Operations and Expressions
+  - JDK-8359433: The final modifier on Windows L&F internal UI classes prevents extending them in apps
+  - JDK-8361339: Test gc/shenandoah/TestLargeObjectAlignment.java#generational fails on macOS aarch64 with OOM: Java heap space
+  - JDK-8361606: ConsumeNextMnemonicKeyTypedTest.java fails on Windows: character typed with VK_A: a
+  - JDK-8361699: C2: assert(can_reduce_phi(n->as_Phi())) failed: Sanity: previous reducible Phi is no longer reducible before SUT
+  - JDK-8361726: Shenandoah: More detailed evacuation instrumentation
+  - JDK-8362428: Update IANA Language Subtag Registry to Version 2025-08-25
+  - JDK-8363943: ARM32: Represent Registers as values
+  - JDK-8363949: Incorrect jtreg header in MonitorWithDeadObjectTest.java
+  - JDK-8363986: Heap region in CDS archive is not at deterministic address
+  - JDK-8364315: Remove unused xml files from test/jaxp/javax/xml/jaxp/functional/javax/xml/transform/xmlfiles
+  - JDK-8364657: Crash for SecureRandom.generateSeed(0) on Windows x86-64
+  - JDK-8364927: Add @requires annotation to TestReclaimStringsLeaksMemory.java
+  - JDK-8365057: Add support for java.util.concurrent lock information to Thread.dump_to_file
+  - JDK-8365379: SU3.applyInsets may produce wrong results
+  - JDK-8365423: [macos26] java/awt/MenuBar/8007006/bug8007006.java fails on macOS 26
+  - JDK-8365424: [macos26] java/awt/Frame/DisposeTest.java fails on macOS 26
+  - JDK-8365623: test/jdk/sun/security/pkcs11/tls/ tests skipped without skip exception
+  - JDK-8365625: Can't change accelerator colors in Windows L&F
+  - JDK-8365792: GenShen: assertion "Generations aren't reconciled"
+  - JDK-8366692: Several gc/shenandoah tests timed out
+  - JDK-8366695: Test sun/jvmstat/monitor/MonitoredVm/MonitorVmStartTerminate.java timed out
+  - JDK-8366852: java/awt/Choice/ChoiceMouseWheelTest/ChoiceMouseWheelTest.java test is failing
+  - JDK-8367096: jdk/open/test/jdk/sun/security/pkcs11/ rsa, ec, config, secmod and sslecc tests are skipping but showing as pass
+  - JDK-8367450: Shenandoah: Log the composition of the collection set
+  - JDK-8367451: GenShen: Remove the option to compute age census during evacuation
+  - JDK-8367473: Shenandoah: Make the detailed evacuation metrics a runtime diagnostic option
+  - JDK-8367485: os::physical_memory is broken in 32-bit JVMs when running on 64-bit OSes
+  - JDK-8367531: Template Framework: use scopes and tokens instead of misbehaving immediate-return-queries
+  - JDK-8367646: [GenShen] Control thread may overwrite gc cancellation cause set by mutator
+  - JDK-8367708: GenShen: Reduce total evacuation burden
+  - JDK-8367709: GenShen: Dirty cards for objects that get promoted by safepoint that intervenes between allocation and stores
+  - JDK-8367722: [GenShen] ShenandoahEvacuationStats is always empty
+  - JDK-8367949: JFR: MethodTrace double-counts methods that catch their own exceptions
+  - JDK-8368001: java/text/Format/NumberFormat/NumberRoundTrip.java timed out
+  - JDK-8368015: Shenandoah: fix error in computation of average allocation rate
+  - JDK-8368041: Enhance TLS certificate handling
+  - JDK-8368159: Significant performance overhead when started with jdwp agent and unattached debugger
+  - JDK-8368181: ProblemList java/awt/Dialog/ModalExcludedTest/ModalExcludedTest.java
+  - JDK-8368307: Shenandoah: get_next_bit_impl should special case weak and strong mark bits
+  - JDK-8368499: GenShen: Do not collect age census during evac when adaptive tenuring is disabled
+  - JDK-8368501: Shenandoah: GC progress evaluation does not use generation
+  - JDK-8368524: Tests are skipped and shown as passed in test/jdk/sun/security/pkcs11/Cipher/KeyWrap
+  - JDK-8368681: Shenandoah: Add documentation comments for ShenandoahAllocationRate
+  - JDK-8369128: ProblemList jdk/jfr/event/profiling/TestCPUTimeSampleQueueAutoSizes.java in Xcomp configs
+  - JDK-8369132: Disable vmTestbase/gc/vector/CircularListLow and LinearListLow with SerialGC
+  - JDK-8369133: Disable gc/g1/TestShrinkAuxiliaryDataRunner.java with UseLargePages option
+  - JDK-8369251: Opensource few tests
+  - JDK-8369561: sun/java2d/OpenGL/DrawBitmaskImage.java#id0: Incorrect color for first pixel (actual=ff000000)
+  - JDK-8369683: Exclude runtime/Monitor/MonitorWithDeadObjectTest.java#DumpThreadsBeforeDetach on Alpine Linux debug
+  - JDK-8369736: Add management interface for AOT cache creation
+  - JDK-8369817: [TESTBUG] EmptyPath::toString is ignored
+  - JDK-8369912: [TESTBUG] testlibrary_tests/template_framework/examples/TestExpressions.java fails with ArithmeticException: / by zero - forgot to respect Expression.info
+  - JDK-8369950: TLS connection to IPv6 address fails with BCJSSE due to IllegalArgumentException
+  - JDK-8370370: Add still more cases to WorstCaseTests
+  - JDK-8370489: Some compiler tests miss the @key randomness
+  - JDK-8370502: C2: segfault while adding node to IGVN worklist
+  - JDK-8370521: GenShen: Various code cleanup related to promotion
+  - JDK-8370939: C2: SIGSEGV in SafePointNode::verify_input when processing MH call from Compile::process_late_inline_calls_no_inline()
+  - JDK-8371284: GenShen: Avoid unnecessary card marking
+  - JDK-8371381: [Shenandoah] Setting ergo flags should use FLAG_SET_ERGO
+  - JDK-8371503: RETAIN_IMAGE_AFTER_TEST do not work for some tests
+  - JDK-8371792: Refactor barrier loop tests out of TestIfMinMax
+  - JDK-8371893: [macOS] use dead_strip linker option to reduce binary size
+  - JDK-8372272: Hotspot shared lib loading - add load attempts to Events::log
+  - JDK-8372351: Add 2 WISeKey roots
+  - JDK-8372380: Make hs_err reporting more robust for unattached threads
+  - JDK-8372513: Shenandoah: ShenandoahMaxRegionSize can produce an unaligned heap alignment
+  - JDK-8372851: Modify java/io/File/GetXSpace.java to print path on failure of native call
+  - JDK-8372861: Genshen: Override parallel_region_stride of ShenandoahResetBitmapClosure to a reasonable value for better parallelism
+  - JDK-8373039: Remove Incorrect Asserts in shenandoahScanRemembered
+  - JDK-8373120: Virtual thread stuck in BLOCKED state
+  - JDK-8373239: Test java/awt/print/PrinterJob/PageRanges.java fails with incorrect selection of printed pages
+  - JDK-8373275: Improve DTLS handshaking
+  - JDK-8373515: Migrate "test/jdk/java/net/httpclient/" to null-safe "SimpleSSLContext" methods
+  - JDK-8373579: Problem list compiler/runtime/Test7196199.java
+  - JDK-8373650: Test "javax/swing/JMenuItem/6458123/ManualBug6458123.java" fails because the check icons are not aligned properly as expected
+  - JDK-8373676: Test javax/net/ssl/HttpsURLConnection/SubjectAltNameIP.java fails on a machine without IPV6
+  - JDK-8373690: Unexpected Keystore message using jdk.crypto.disabledAlgorithms
+  - JDK-8373714: Shenandoah: Register heuristic penalties following a degenerated GC
+  - JDK-8373718: jdk/internal/misc/VM/RuntimeArguments.java test fails in Virtual threads mode
+  - JDK-8373796: Refactor java/net/httpclient/ThrowingPublishers*.java tests to use JUnit5
+  - JDK-8373847: Test javax/swing/JMenuItem/MenuItemTest/bug6197830.java failed because The test case automatically fails when clicking any items in the “Nothing” menu in all four windows (Left-to-right)-Menu Item Test and (Right-to-left)-Menu Item Test
+  - JDK-8373866: Refactor java/net/httpclient/ThrowingSubscribers*.java tests to use JUnit5
+  - JDK-8373893: Refactor networking http server tests to use JUnit
+  - JDK-8373913: Refactor serialization tests to use JUnit
+  - JDK-8373928: 4 Dangling pointer defect groups in java.c
+  - JDK-8374001: sun/security/ skip without Exceptions
+  - JDK-8374058: Enhance JPEG handling
+  - JDK-8374168: Resolve disabled warnings in JDWP agent
+  - JDK-8374304: MultiResolutionSplashTest.java fails in CI: "Image with wrong resolution is used for splash screen!"
+  - JDK-8374322: TestMemoryWithSubgroups.java fails Permission denied
+  - JDK-8374343: Fix SIGSEGV when lib/modules is unreadable
+  - JDK-8374449: Shenandoah: Leaf locks used by Shenandoah need lower ranks
+  - JDK-8374506: Incorrect positioning of arrow icon in parent JMenu in Windows L&F
+  - JDK-8374712: AOTMappedHeapWriter::relocate_field_in_buffer should use CompressedOops::narrow_oop_cast
+  - JDK-8374727: Audio configuration Platform class - use nio for getting endianness of the underlying platform
+  - JDK-8374744: Enable dumping of APX EGPRs (R16–R31) in JVM fatal error logs
+  - JDK-8374769: PPC: MASM::pop_cont_fastpath() should reset _cont_fastpath if SP == _cont_fastpath
+  - JDK-8374888: Implement internal test cache to help UserIterCount test performance
+  - JDK-8374998: Failing os::write - remove bad file
+  - JDK-8375065: Update LCMS to 2.18
+  - JDK-8375177: Gtest os_linux.decoder_get_source_info_valid_vm fails with -ffunction-sections
+  - JDK-8375294: (fs) Files.copy can fail with EOPNOTSUPP when copy_file_range not supported
+  - JDK-8376031: HttpsURLConnection.getServerCertificates() throws "java.lang.IllegalStateException: connection not yet open" for the HEAD method
+  - JDK-8376104: C2 crashes in PhiNode::Ideal(PhaseGVN*, bool) accessing NULL pointer
+  - JDK-8376151: Test javax/swing/JFileChooser/4966171/bug4966171.java is failing with OOME
+  - JDK-8376152: Test javax/sound/sampled/Clip/bug5070081.java timed out then completed
+  - JDK-8376185: NoSuchFieldError thrown after a record with type annotation retransformed
+  - JDK-8376233: Clean up code in Desktop native peer
+  - JDK-8376287: Crashes when using -XX:ObjArrayMarkingStride=0
+  - JDK-8376402: Dependencies::print_statistics() and AbstractClassHierarchyWalker::print_statistics() are not called from PRODUCT code
+  - JDK-8376684: Compile OpenJDK in headless mode without required X11 libraries
+  - JDK-8376956: Add JVMTI phase entering/setting to hserr event log
+  - JDK-8376969: Shenandoah: GC state getters should be inlineable
+  - JDK-8376970: Shenandoah: Verifier should do basic verification before touching oops
+  - JDK-8377158: Enhance XBM image support
+  - JDK-8377167: javax/imageio/ReadAbortTest.java throw NPE when x11 unavailable
+  - JDK-8377498: Improve HttpServer handling
+  - JDK-8377512: AOT cache creation fails with invalid native pointer
+  - JDK-8377602: Create automated test for PageRange
+  - JDK-8377727: Ghost caret and focus appear in non‑editable text fields
+  - JDK-8377833: Enhance Jar file processing
+  - JDK-8377907: (process) Race in ProcessBuilder can cause JVM hangs
+  - JDK-8377910: Minor cleanup of java/io/FileDescriptor/Sharing.java
+  - JDK-8377932: AOT cache is not rejected when JAR file has changed
+  - JDK-8377944: LowMemoryTest2.java#id1 intermittent fails OOME: Metaspace
+  - JDK-8377949: TestZRelocationSetEvent.java intermittent fails OOME
+  - JDK-8378083: Mark shenandoah/generational/TestOldGrowthTriggers.java as flagless
+  - JDK-8378201: [OGL] glXMakeContextCurrent() drops the buffers of the unbound drawable
+  - JDK-8378417: Printing All pages results in NPE for 1.1 PrintJob
+  - JDK-8378561: Mark gc/shenandoah/compiler/TestLinkToNativeRBP.java as /native
+  - JDK-8378687: Improve delegation of HttpURLConnection
+  - JDK-8378727: [macOS] Missing dispatch_release for semaphores in CDesktopPeer
+  - JDK-8378746: ZGC: jdk/jfr/event/gc/detailed/TestZRelocationSetGroupEvent.java intermittent OOME
+  - JDK-8378764: fileStream::fileSize() fails for >2GB files on Windows
+  - JDK-8378774: Bump update version for OpenJDK: jdk-25.0.4
+  - JDK-8378810: Enable missing FFM test via jtreg requires for RISC-V
+  - JDK-8378836: Enable linktime-gc by default on Linux ppc64le
+  - JDK-8378878: Refactor java/nio/channels/AsynchronousSocketChannel test to use JUnit
+  - JDK-8378888: jdk/incubator/vector/Float16OperationsBenchmark.java uses wrong package name
+  - JDK-8379021: Shenandoah: Speedup ShenandoahSimpleBitMapTest
+  - JDK-8379202: Support linktime-gc on Linux with clang
+  - JDK-8379416: AIX build fails if system (not GNU) date tool is in PATH
+  - JDK-8379425: Windows and macOS should not allow unsupported headless-only build
+  - JDK-8379457: Test EATests.java#id0 ERROR: monitor list errors: error_cnt=1
+  - JDK-8379464: Enable missing stack walking test via jtreg requires for RISC-V
+  - JDK-8379499: [AIX] headless-only build of libjawt.so fails
+  - JDK-8379515: draft-ietf-lamps-kyber-certificates is now RFC 9935
+  - JDK-8380011: Path-to-gcroots search should not trigger stack overflows
+  - JDK-8380041: PPC: remove POWER6 remnants
+  - JDK-8380222: Refactor test/jdk/java/lang/Character TestNG tests to JUnit
+  - JDK-8380316: Test runtime/os/AvailableProcessors.java fails Invalid argument
+  - JDK-8380409: JVM crashes when -XX:AOTMode=create uses app.aotconf generated with JVMTI agent
+  - JDK-8380428: ProblemList containers/docker/TestJcmdWithSideCar.java on linux-all
+  - JDK-8380431: Shenandoah: Concurrent modification of stack-chunk objects during evacuation
+  - JDK-8380474: Crash SEGV in ThreadIdTable::lazy_initialize  after JDK-8323792
+  - JDK-8380565: PPC64: deoptimization stub should save vector registers
+  - JDK-8380663: Update jcmd man page to include AOT.end_recording diagnostic command
+  - JDK-8380672: Improve certification checking
+  - JDK-8380846: GenShen: Remove the experimental option to disable adaptive tenuring
+  - JDK-8380947: Add pull request template
+  - JDK-8381039: Enhance AWT ImagingLib
+  - JDK-8381049: Enhance Jar handling
+  - JDK-8381205: GHA: Upgrade Node.js 20 to 24
+  - JDK-8381315: compiler/vectorapi/TestVectorReallocation.java fails with -XX:UseAVX=1 after JDK-8380565
+  - JDK-8381382: Shenandoah: assert(capacity > 0) failed: free regions must have allocation capacity
+  - JDK-8381519: Enhance Der Value Handling
+  - JDK-8381796: Enhance Certificate parsing
+  - JDK-8381871: GenShen: ShenandoahGCHeuristics flag not reset after ignoring non-adaptive value
+  - JDK-8381935: Improve numChunks range in the PPC64 CallAranger
+  - JDK-8381937: Make exceptions in Java_sun_security_mscapi_CKeyPairGenerator generateCKeyPair more specific
+  - JDK-8382018: test/jdk/java/nio/file/spi/SetDefaultProvider.java leaves a directory in /tmp
+  - JDK-8382020: Time Zone Abbreviation Not Localized for Non-English Locales
+  - JDK-8382035: [ubsan] Under UBSAN builds, disable tests that rely on simulated JVM crashes
+  - JDK-8382090: Remove .rej and .orig from .gitignore
+  - JDK-8382242: JFR: Metadata reconstruction invalidates ConstantMap for java.lang.String
+  - JDK-8382295: Shenandoah: wrong denominator in full gc summary
+  - JDK-8382395: Disable stringop-overflow in shenandoahGenerationalHeap.cpp
+  - JDK-8382419: Add missed @key randomness after JDK-8370489
+  - JDK-8382522: Disable stringop-overflow in safepointMechanism.cpp
+  - JDK-8382740: JFR: Disable jdk.OldObjectSample event for generational ZGC
+  - JDK-8382878: RISC-V: Missing InlineSkippedInstructionsCounter in ZGC barriers stubs
+  - JDK-8382932: [25u] Test java/lang/instrument/RetransformRecordTypeAnn/TestRetransformRecord.java‎ fails with compilation error
+  - JDK-8383161: [PPC64] MachCallDynamicJavaNode::ret_addr_offset() needs adaptation for COH
+  - JDK-8383175: (tz) Update Timezone Data to 2026b
+  - JDK-8383183: Shenandoah: Mangle trashed regions up to top instead of end
+  - JDK-8383354: Update LCMS to 2.19.1
+  - JDK-8383473: Follow on from tzdata2026b time change to include temporary hack BC time change
+  - JDK-8383601: RISC-V: ShenandoahBarrierSetAssembler::load_reference_barrier calls "weak" on "phantom" path
+  - JDK-8383630: Fix iteration in tests doing class redefinition
+  - JDK-8384043: [REDO] Incorrect handling of Hawaii_Aleutian metazone
+  - JDK-8384158: GHA: Downgrade Windows GHA runners to windows-2022 temporarily
+  - JDK-8384163: (so) SocketChannel.connect and finishConnect() exception messages could be improved
+  - JDK-8384223: RISC-V: entry_barrier_offset should consider UseZtso
+  - JDK-8384486: NTLM tests fail on Windows 11 and Windows Server 2025
+  - JDK-8384495: Update Libpng to 1.6.58
+  - JDK-8384540: [25u, 21u, 17u] Update GHA JDKs after Apr/26 updates
+  - JDK-8384815: SelectOneKeyOutOfMany and PreferredKey fail after expired test certificate
+  - JDK-8384902: Update GIFlib to 6.1.3
+  - JDK-8385390: Update FreeType to 2.14.3
+  - JDK-8385490: Update HarfBuzz to 14.2.0
+  - JDK-8386551: Windows build broken because of MSys2/Make update
+
+Notes on individual issues:
+===========================
+
+hotspot/svc:
+
+JDK-8365057: Add support for java.util.concurrent lock information to Thread.dump_to_file
+=========================================================================================
+An AbstractOwnableSynchronizer lock object has a notion of exclusive
+ownership by a particular thread.  When another thread is parked
+waiting on this lock, this information is now obtained and presented
+as part of the thread dump provided by the
+com.sun.management.HotSpotDiagnosticMXBean.dumpThreads API and the
+`jcmd <pid> Thread.dump_to_file` command.
+
+security-libs/javax.crypto:
+
+JDK-8347938: Add Support for the Latest ML-KEM and ML-DSA Private Key Encodings
+===============================================================================
+
+This release of OpenJDK adds support for encoding ML-KEM and ML-DSA
+keys to PKCS#8 format using the DER-encoded ASN.1 CHOICE formats
+defined in Section 6, "Private Key Format" of RFC 9935 [0] and RFC
+9881 [1].  This format is referred to as "seed".
+
+This release also introduces two new security and system properties to
+control which PKCS#8 encoding is used.  This encoding is used when
+generating new keys with a `KeyPairGenerator` and as the output when
+translating them with `KeyFactory.translateKey`.  These properties are
+`jdk.mlkem.pkcs8.encoding` and `jdk.mldsa.pkcs8.encoding`.
+
+The possible case-insensitive values of these properties are:
+
+* `seed`; the new format introduced in this release and the default.
+This is 64 bytes for ML-KEM and 32 bytes for ML-DSA.
+* `expandedKey`; the format used on introduction of ML-KEM and ML-DSA
+keys in OpenJDK 24.
+* `both`; a sequence containing both encodings.
+
+As older OpenJDK releases do not support the encoding introduced by
+this release, they will not be able to decode keys generated using the
+new default.  To produce a key compatible with older releases, the
+encoding should be set to `encodedKey` and then the key either
+generated or an existing key passed to `translateKey`.
+
+As with all security and system property pairs, specifying a non-empty
+value for the system property takes precedence over the security
+property.
+
+[0] https://www.rfc-editor.org/rfc/rfc9935.html#name-private-key-format
+[1] https://www.rfc-editor.org/rfc/rfc9881.html#name-private-key-format
+
+hotspot/jfr:
+
+JDK-8382740: JFR: Disable jdk.OldObjectSample event for generational ZGC
+========================================================================
+Leak profiling using the JFR event `jdk.OldObjectSample` is now
+disabled for generational ZGC due to performance issues.  Generational
+ZGC only does weak reference processing in the old generation, so
+sampling will cause garbage to be artificially kept alive until an old
+generation collection.
+
+security-libs/java.security:
+
+JDK-8372351: Add 2 WISeKey roots
+================================
+The following root certificates have been added to the cacerts
+truststore:
+
+Alias Name: wisekeyglobalrootgbca
+Distinguished Name: CN=OISTE WISeKey Global Root GB CA, OU=OISTE Foundation Endorsed, O=WISeKey, C=CH
+Serial Number: 76b1205274f0858746b3f8231af6c2c0
+Valid From: Mon Dec 01 15:00:32 GMT 2014
+Valid Until: Thu Dec 01 15:10:31 GMT 2039
+
+Alias Name: wisekeyglobalrootgcca
+Distinguished Name: CN=OISTE WISeKey Global Root GC CA, OU=OISTE Foundation Endorsed, O=WISeKey, C=CH
+Serial Number: 212a560caeda0cab4045bf2ba22d3aea
+Valid From: Tue May 09 09:48:34 GMT 2017
+Valid Until: Fri May 09 09:58:33 GMT 2042
+
+JDK-8381796: Enhance Certificate parsing
+========================================
+With this release of OpenJDK, a security and system property
+`com.sun.security.crl.maxSize` is introduced which acts as a maximum
+size limit on a Certificate Revocation List (CRL) downloaded over the
+network.  For URICertStore requests, the value is the maximum size in
+bytes of the DER-encoded CRL.  For LDAPCertStore queries, the
+threshold is the sum of all CRLs downloaded from a single search.  By
+default, the maximum size is 20MiB (20971520 bytes) and CRLs larger
+than this will be discarded.  A value less than zero may be used to
+turn off the size limit and non-numeric values will be ignored.  A
+non-empty value for the system property takes precedence over the
+security property.  Enabling 'certpath' debug logging will output the
+current size limit and note any discarded CRLs.
+
 New in release OpenJDK 25.0.3 (2026-04-21):
 ===========================================
 Live versions of these release notes can be found at:
--- a/java-25-openjdk.spec
+++ b/java-25-openjdk.spec
@ -6,10 +6,10 @@
 # New Version-String scheme-style defines
 %global featurever 25
 %global interimver 0
-%global updatever 3
+%global updatever 4
 %global patchver 0
-%global buildver 9
-%global portablerelease 3
+%global buildver 7
+%global portablerelease 1
 %global rpmrelease 1

 # Define IcedTea version used for SystemTap tapsets and desktop file
@ -1165,8 +1165,8 @@ Requires: ca-certificates
 # Require javapackages-filesystem for ownership of /usr/lib/jvm/ and macros
 Requires: javapackages-filesystem
 # Require zone-info data provided by tzdata-java sub-package
-# 2026a required as of JDK-8379035
-Requires: tzdata-java >= 2026a
+# 2026b required as of JDK-8383175
+Requires: tzdata-java >= 2026b
 # for support of kernel stream control
 # libsctp.so.1 is being `dlopen`ed on demand
 Requires: lksctp-tools%{?_isa}
@ -1395,8 +1395,6 @@ Patch1001: fips-%{featurever}u-%{fipsver}.patch
 #
 #############################################

-# JDK-8375294: (fs) Files.copy can fail with EOPNOTSUPP when copy_file_range not supported
-Patch2001: jdk8375294-handle-EOPNOTSUPP-in-copying.patch
 # JDK-8347901: C2 should remove unused leaf / pure runtime calls
 Patch2002: jdk8347901-c2_unused_leaf_removal.patch
 # JDK-83787313: C2: performance regression due to missing constant folding for Math.pow()
@ -1465,8 +1463,8 @@ BuildRequires: %{pkgnameroot}-misc = %{epoch}:%{version}-%{prelease}.%{portables
 %ifarch %{zero_arches}
 BuildRequires: libffi-devel
 %endif
-# 2026a required as of JDK-8379035
-BuildRequires: tzdata-java >= 2026a
+# 2026b required as of JDK-8383175
+BuildRequires: tzdata-java >= 2026b
 # Earlier versions have a bug in tree vectorization on PPC
 BuildRequires: gcc >= 4.8.3-8

@ -1489,17 +1487,17 @@ BuildRequires: libpng-devel
 BuildRequires: zlib-devel
 %else
 # Version in src/java.desktop/share/legal/freetype.md
-Provides: bundled(freetype) = 2.14.2
+Provides: bundled(freetype) = 2.14.3
 # Version in src/java.desktop/share/native/libsplashscreen/giflib/gif_lib.h
-Provides: bundled(giflib) = 6.1.2
+Provides: bundled(giflib) = 6.1.3
 # Version in src/java.desktop/share/native/libharfbuzz/hb-version.h
-Provides: bundled(harfbuzz) = 12.3.2
+Provides: bundled(harfbuzz) = 14.2.0
 # Version in src/java.desktop/share/native/liblcms/lcms2.h
-Provides: bundled(lcms2) = 2.17.0
+Provides: bundled(lcms2) = 2.19.1
 # Version in src/java.desktop/share/native/libjavajpeg/jpeglib.h
 Provides: bundled(libjpeg) = 6b
 # Version in src/java.desktop/share/native/libsplashscreen/libpng/png.h
-Provides: bundled(libpng) = 1.6.57
+Provides: bundled(libpng) = 1.6.58
 # Version in src/java.base/share/native/libzip/zlib/zlib.h
 Provides: bundled(zlib) = 1.3.2
 %endif
@ -1923,8 +1921,6 @@ sh %{SOURCE12} %{top_level_dir_name}
 pushd %{top_level_dir_name}
 # Add crypto policy and FIPS support
 %patch -P1001 -p1
-# Add EOPNOTSUPP patch
-%patch -P2001 -p1
 # Add C2 patches
 %patch -P2002 -p1
 %patch -P2003 -p1
@ -2602,6 +2598,19 @@ exit 0
 %endif

 %changelog
+* Thu Jul 16 2026 Andrew Hughes <gnu.andrew@redhat.com> - 1:25.0.4.0.7-1.0
+- Update to jdk-25.0.4+7 (GA)
+- Update release notes to 25.0.4+7
+- Bump freetype version to 2.14.3 following JDK-8385390
+- Bump giflib version to 6.1.3 following JDK-8384902
+- Bump HarfBuzz version to 14.2.0 following JDK-8385490
+- Bump lcms2 version to 2.19.1 following JDK-8375065 & JDK-8383354
+- Bump libpng version to 1.6.58 following JDK-8384495
+- Require tzdata 2026b due to upstream inclusion of JDK-8383175
+- Drop local copy of JDK-8375294 EOPNOTSUPP patch
+- ** This tarball is embargoed until 2026-07-21 @ 1pm PT. **
+- Resolves: RHEL-188883
+
 * Tue Jul 14 2026 Andrew Hughes <gnu.andrew@redhat.com> - 1:25.0.3.0.9-3.1
 - Cleanup tagging and gating scripts to appease shellcheck:
 - * scripts/builds/build_vanilla.sh: Use an array to handle the varying arguments to rhpkg.
--- a/jdk8375294-handle-EOPNOTSUPP-in-copying.patch
+++ b/jdk8375294-handle-EOPNOTSUPP-in-copying.patch
@ -1,63 +0,0 @@
-From dbbdc1dffd10608195487fa139e77c4a90c80658 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Ji=C5=99=C3=AD=20Van=C4=9Bk?= <jvanek@openjdk.org>
-Date: Wed, 15 Apr 2026 12:54:49 +0000
-Subject: [PATCH] 8375294: (fs) Files.copy can fail with EOPNOTSUPP when
- copy_file_range not supported
-
-Reviewed-by: andrew
-Backport-of: 30cda00010888b6e9a2bf8cdeaedbb3eb4b6a222
---
- src/java.base/linux/native/libnio/ch/FileDispatcherImpl.c    | 5 +++--
- src/java.base/linux/native/libnio/fs/LinuxNativeDispatcher.c | 3 ++-
- 2 files changed, 5 insertions(+), 3 deletions(-)
-
-diff --git a/src/java.base/linux/native/libnio/ch/FileDispatcherImpl.c b/src/java.base/linux/native/libnio/ch/FileDispatcherImpl.c
-index efbd0ca5684..54d640b03a4 100644
--- a/src/java.base/linux/native/libnio/ch/FileDispatcherImpl.c
-+++ b/src/java.base/linux/native/libnio/ch/FileDispatcherImpl.c
-@@ -1,5 +1,5 @@
- /*
- * Copyright (c) 2000, 2024, Oracle and/or its affiliates. All rights reserved.
-+ * Copyright (c) 2000, 2026, Oracle and/or its affiliates. All rights reserved.
-  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
-  *
-  * This code is free software; you can redistribute it and/or modify it
-@@ -63,7 +63,7 @@ Java_sun_nio_ch_FileDispatcherImpl_transferFrom0(JNIEnv *env, jobject this,
-     if (n < 0) {
-         if (errno == EAGAIN)
-             return IOS_UNAVAILABLE;
-        if (errno == ENOSYS)
-+        if (errno == ENOSYS || errno == EOPNOTSUPP)
-             return IOS_UNSUPPORTED_CASE;
-         if ((errno == EBADF || errno == EINVAL || errno == EXDEV) &&
-             ((ssize_t)count >= 0))
-@@ -103,6 +103,7 @@ Java_sun_nio_ch_FileDispatcherImpl_transferTo0(JNIEnv *env, jobject this,
-                 case EINVAL:
-                 case ENOSYS:
-                 case EXDEV:
-+                case EOPNOTSUPP:
-                     // ignore and try sendfile()
-                     break;
-                 default:
-diff --git a/src/java.base/linux/native/libnio/fs/LinuxNativeDispatcher.c b/src/java.base/linux/native/libnio/fs/LinuxNativeDispatcher.c
-index c90e99dda07..4677411b0ba 100644
--- a/src/java.base/linux/native/libnio/fs/LinuxNativeDispatcher.c
-+++ b/src/java.base/linux/native/libnio/fs/LinuxNativeDispatcher.c
-@@ -1,5 +1,5 @@
- /*
- * Copyright (c) 2008, 2024, Oracle and/or its affiliates. All rights reserved.
-+ * Copyright (c) 2008, 2026, Oracle and/or its affiliates. All rights reserved.
-  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
-  *
-  * This code is free software; you can redistribute it and/or modify it
-@@ -193,6 +193,7 @@ Java_sun_nio_fs_LinuxNativeDispatcher_directCopy0
-                     case EINVAL:
-                     case ENOSYS:
-                     case EXDEV:
-+                    case EOPNOTSUPP:
-                         // ignore and try sendfile()
-                         break;
-                     default:
-- 
-2.52.0
-
--- a/2
+++ b/2
@ -1,3 +1,3 @@
 SHA512 (tapsets-icedtea-6.0.0pre00-c848b93a8598.tar.xz) = 97d026212363b3c83f6a04100ad7f6fdde833d16579717f8756e2b8c2eb70e144a41a330cb9ccde9c3badd37a2d54fdf4650a950ec21d8b686d545ecb2a64d30
 SHA512 (nssadapter-0.1.1.tar.xz) = 2b4675cfbfa2ccb6c9a4870a4b58ae555267f5b8c9bdb0cf37b075483e6e9ea929561c05070453cf0d67b0b029de5408274555bf2ff50e9533219e898b2717f9
-SHA512 (openjdk-25.0.3+9.tar.xz) = 382dcf42ede35c7e48e0f9403d30172e6bc6367517e0c49211ab9d2e43373c3d7e586969c27795f0bfd17ae5c9f00702e955495a31d7ea757f54f06e8a4cf113
+SHA512 (openjdk-25.0.4+7.tar.xz) = bd2c336ba2f0196e361bc8fd81a39cd9907682c0fac3a2b24a703a2abcede0fc75247fc54767329fc45d2f562f2728e3691db864363e9ab326c8218280831494